I will update this story if Ivanti or CISA publish new details.

◢What happened

The flaws form a chain. The first, CVE-2026-104935, is an authentication bypass: CISA describes it as letting a remote attacker with no credentials run commands on the device. It was added to CISA's catalog on October 13 and Ivanti patched it then.

The two new ones complete the attack. CVE-2026-118527 lets an attacker upload files with content of their choosing to a known location on disk, and CVE-2026-111357 allows privilege escalation on the device. According to security firm Volexity, which documented the chain earlier this month and is quoted by The Hacker News, combining the three flaws gives unauthenticated, root-level code execution, meaning full control over the appliance.

When the exploitation was discovered, Ivanti already had a fix ready for the first flaw and chose to ship it without waiting for the privilege escalation fix, because it shut down the main way in. It has now released a version that fixes every vulnerability in the chain.

◢What the attackers did once inside

Volexity attributes the attacks to a previously undocumented actor it calls UTA0576. No one has officially linked that name to any known group or country.

What stands out is what they were after. Instead of dropping malware or backdoors, as usually happens in attacks like this, The Hacker News reports that UTA0576 extracted credentials and some Active Directory metadata, ran reconnaissance on the device and searched for administrator passwords and BitLocker recovery keys, the keys to Windows disk encryption.

That has a practical consequence. Even if you patch today, if the device was hit earlier, the stolen passwords still work. Patching closes the door, but it does not change the keys that were already taken.

◢Is my company affected?

If your company runs Ivanti Connect Secure (formerly Pulse Connect Secure) and has not updated it in the last few weeks, yes. According to The Hacker News, the new fixes ship in these versions:

• ▹The 25.1.1 branch, fixed in 25.1.1.3 (affects 25.1.1.2 and earlier).
• ▹The 22.8R2 branch, fixed in 22.8R2.6 (affects 22.8R2.5 and earlier).

Ivanti also says it found part of the problem through its own security program and fixed it in the July 25.1.3.0 release. For the exact version that applies to you, the reference is Ivanti's official advisory².

If you don't know which VPN your company uses, ask whoever runs your IT or the provider that manages it for you. It takes a minute.

◢What to do now

CISA requires US federal agencies to apply the fix for CVE-2026-111357 by November 2 and for CVE-2026-118527 by November 13. Those deadlines don't bind a European company, but they show the urgency: this is a matter of days, not weeks.

For the technical team:

• ▹Update Ivanti Connect Secure to the fixed version for your branch.
• ▹Check whether the device shows signs of compromise over the past few weeks, following the guidance in Ivanti's advisory. For CVE-2026-111357, CISA also requires its agencies to carry out forensic triage, which tells you how seriously it takes this.
• ▹If there are signs of intrusion, reset the passwords of accounts that go through the VPN, starting with admin and domain accounts, and review who has accessed BitLocker recovery keys.

For management, the lesson is simpler. A VPN is exposed to the internet by design, and it is one of the first places attackers look. You should know who maintains it, how often it gets updated and who receives the vendor's security advisories.

◢What to take away

I have written on this blog that most attacks come in through an email, and that still holds for most companies. This case is the flip side: when an internet-facing device has a flaw like this, the attacker doesn't need to trick anyone. That is why the two go together, staff who can spot a scam and systems that get updated on time.

One more point for decision makers. Patching quickly is necessary, but it isn't enough. If credentials pass through a device that has been exposed, assume they may be compromised and make sure two-factor authentication is on for everything that matters.

If you want your team to understand why this matters without needing to be technical, that is exactly what I cover in my cybersecurity training.